Vulnerabilidades de Capgo
CVEs publicadas que afetam produtos de Capgo: 106 registro(s), com severidade, exploração e correções.
CVE-2026-56079
Média · 6.5
CWE-200 19/06/2026
Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access
Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other tenants' webhook secrets and delivery logs. Attackers can query the webhooks and webhook_deliveries endpoints to exfiltrate HMAC signing secrets and delivery payloads, enabling forged webhook events against victim organizations.
CVE-2026-56073
Crítica · 9.4
CWE-345 19/06/2026
Cap-go: bypass de verificação OTP por manipulação de respostas do servidor
O Cap-go antes da 12.128.2 contém uma vulnerabilidade de bypass de autenticação na verificação OTP que permite que atacantes contornem a verificação de e-mail modificando respostas do servidor. Atacantes podem interceptar requisições de verificação OTP e manipular respostas HTTP para marcar falsamente a verificação como bem-sucedida, possibilitando a ativação não autorizada de 2FA e a tomada de conta.
CVE-2026-53868
Alta · 7.5
CWE-306 12/06/2026
Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion
Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of the platform for 30 days by exploiting unverified email ownership in account lifecycle operations.
CVE-2026-53867
Média · 4.3
CWE-459 12/06/2026
Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement
Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content.
CVE-2026-53982
Média · 6.5
CWE-645 12/06/2026
Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier Association
Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an attacker to block authentication and onboarding functions by triggering account deletion while a device identifier is linked to the active session. The platform incorrectly associates the deletion state with the device identifier, causing the affected device or browser environment to be redirected to an account-disabled page for approximately 30 days, preventing any account login or registration from that device.
CVE-2026-53981
Alta · 7.6
CWE-306 12/06/2026
Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism
Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication such as password or MFA verification. Attackers can redirect verification to an attacker-controlled email address and subsequently perform a password reset to permanently take over the victim's account.